CVE-2026-73492: falha de baixa gravidade em flavorjones loofah
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.3epss 0.4%
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as :, 	, 
, or 
. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
flavorjones · loofahCVEs relacionadas — flavorjones loofah
No mesmo produto, das mais perigosas para as menos.
CVE-2022-23514HIGHInefficient Regular Expression Complexity in LoofahEPSS 1.8%CVE-2022-23516HIGHUncontrolled Recursion in LoofahEPSS 1.2%CVE-2022-23515MEDIUMImproper neutralization of data URIs may allow XSS in LoofahEPSS 0.9%CVE-2026-73491LOWLoofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesEPSS 0.4%CVE-2026-73490MEDIUMLoofah: SVG `href` attribute bypasses local-reference restrictionEPSS 0.3%